Created attachment 144142[details]
Fix for issue (1), singlesample_mt use after free
In src/mesa/drivers/dri/i965/intel_mipmap_tree.c intel_update_winsys_renderbuffer_miptree() the intel_miptree_create_for_renderbuffer() call can fail and the function is prepared for it.
However, there are several issues with the error handling:
(1) On failure exit from intel_update_winsys_renderbuffer_miptree(), the singlesample_mt received via parameter remains assigned to irb->singlesample_mt. However, in both callsites (brw_context.c intel_process_dri2_buffer() and intel_update_image_buffer()) the miptree is released on failure. This will lead to use-after-free and undefined behavior, including crashes.
Either singlesample_mt should be NULLed or it should not be freed by caller.
I have no idea which one would be correct, but I've attached a patch that does the former that seems to fix the use-after-free issues.
(2) On failure exit from intel_update_winsys_renderbuffer_miptree(), irb->mt remains NULL. However, many functions seem to assume that irb->mt is non-null:
(I) do_single_blorp_clear()
(II) brw_postdraw_set_buffers_need_resolve()
(III) update_renderbuffer_surfaces()
There are probably more, but those are the ones I saw crashes in with the test code.
An example callpath for (I) above is:
brw_clear()
=> intel_prepare_render()
=> intel_update_renderbuffers()
=> intel_process_dri2_buffer()
=> intel_update_winsys_renderbuffer_miptree()
=> fails, irb->mt = NULL
=> brw_blorp_clear_color()
=> do_single_blorp_clear()
=> dereferences irb->mt, segfault
Attached is a hack patch that adds NULL checks to some places, but I imagine a better way would be to somehow remove the renderbuffer altogether or something to avoid having to add mt NULL checks everywhere...
I will open a separate issue for the failure in intel_miptree_create_for_renderbuffer() that triggers this, but I think the error handling should be fixed regardless of the failure reason - at least so that there are no crashes.
I've attached the test application I used as mesa-issue-qt3d.cc. With the patches I still don't see correct graphical output with it (I see the red line as expected but the picture flashes rapidly), but I guess it may be expected with the miptree creation failure - I do see correct output after making miptree creation work.
Also included is an apitrace and glxinfo with mesa master without any patches.
This was tested on a ValleyView Gen7 (8086:0f31) with kernel 3.10.35, git master mesa (2019-05-02). AFAICS the issues can happen with any HW/kernel as long as intel_update_winsys_renderbuffer_miptree() manages to fail.